Compliance Analyst

About Allia Health Group

Allia Health Group is a fast-growing digital health system revolutionizing metabolic, hormonal, and longevity care. As the parent organization behind Brello Health (women's telehealth and longevity programs), HelloWellness (men's telehealth), Southend Pharmacy (a state-licensed 503A compounding pharmacy), and Zito Care (our healthcare provider network), we deliver seamless, end-to-end care powered by a shared technology and AI platform. We remove barriers so clinicians can focus on patients and patients can access personalized, proactive care on their own terms — whether through telehealth visits, compounded medications, lab testing, wellness support, and more, all in one connected experience across 35+ states. Allia is building the future of healthcare by being clinician-first and patient-centered. We are innovative, empathetic, and accessible to our patients, combining cutting-edge tools with human-centered care to make high-quality longevity and wellness solutions affordable and available to more people. Position Overview This role supports the day-to-day operation of the company's SOC 2 program, and over time will help build out our ISO 42001 AI Management System (AIMS) and AI governance program. The immediate priority is keeping SOC 2 controls, evidence, and remediation on track throughout the year, not just ahead of audit season. The analyst will work with IT (including the CTO/CISO and their team), Security, HR, Legal, and other control owners to turn compliance requirements into concrete tasks, keep evidence current, flag gaps early, and keep the organization audit-ready on an ongoing basis. The role reports to the Chief Compliance Officer, who retains ownership of the compliance program. The analyst operationalizes and maintains technology-related controls alongside IT while providing independent compliance oversight. Key Responsibilities SOC 2 & continuous compliance Coordinate evidence collection, validation, and remediation across control owners; follow up on overdue or incomplete items.

Maintain audit readiness year-round rather than treating SOC 2 as an annual exercise.

Identify control gaps, exceptions, and deficiencies, and coordinate remediation with the responsible team.

Support SOC 2 Type 2 audit fieldwork and auditor requests.

Escalate overdue or material issues to the CCO and relevant IT/business leadership.

Drata administration Operate and maintain Drata day to day, including API integrations and automated evidence sources.

Investigate and remediate failed automated tests and compliance exceptions.

Keep evidence complete, accurate, and correctly mapped to controls.

Look for ways to automate manual evidence collection and cut recurring effort.

ISO 42001 & AI governance Support building the AIMS: policies, procedures, controls, risk assessments, and supporting documentation.

Help build and maintain an inventory of AI systems, applications, and use cases.

Coordinate AI risk and impact assessments, control activities, and evidence collection.

Work with IT and business stakeholders to put AI governance requirements into practice.

Support future ISO 42001 readiness assessments and certification work.

SaaS & vendor governance Maintain the SaaS/technology inventory.

Support security and compliance reviews for new and existing vendors (SOC reports, questionnaires, certifications, contract requirements).

Track vendor compliance gaps and remediation, and keep related evidence current for SOC 2 and applicable ISO 42001 requirements.

Risk management Maintain the risk register and coordinate periodic updates with risk owners.

Support information security, technology, third-party, and AI-related risk assessments.

Facilitate quarterly access reviews and track completion and remediation.

Escalate material or overdue risks to the CCO and appropriate leadership.

Audit readiness Organize and maintain documentation for SOC 2 and ISO 42001 assessments.

Coordinate responses to auditor and assessor requests, and maintain audit trails.

Track findings and corrective actions through closure.

Reporting Build monthly compliance and IT dashboards for leadership: MFA coverage, access review completion, onboarding/offboarding SLAs, evidence completion, remediation status, vendor reviews, and trends.

Surface upcoming deadlines, overdue items, and risks that need management attention.

Qualifications 2–5 years in compliance, GRC, information security, IT audit, or risk management.

Working knowledge of SOC 2 and information security controls.

Experience with a GRC/continuous compliance platform (Drata, Vanta, Secureframe, or similar).

Experience coordinating evidence collection and remediation across technical and business teams.

Familiarity with NIST, ISO 27001, or CIS Controls.

Strong organizational skills and comfort managing multiple stakeholders and deadlines.

Strong written and verbal communication.

Able to work independently, spot gaps, and drive issues to resolution.

Preferred Experience supporting ISO 42001 or another AI management system.

Experience with AI governance, AI risk assessments, or emerging technology risk.

HIPAA or healthcare compliance experience, ideally in a technology or regulated environment.

ISO 27001 or other ISO management-system experience.

CISA, CISM, CRISC, Security+, ISO 27001, or ISO 42001 certification or training.

What success looks like Continuous SOC 2 readiness, evidence and remediation completed on time, clear accountability among control owners, and fewer items requiring manual escalation. Over time, a working foundation for ISO 42001 and AI governance: a documented AI inventory, risks, controls, and ongoing monitoring. What We Offer: Full benefits package including medical, vision, dental, 401(k) with company match, PTO, Flex days, holidays, and more!

Allia Health Group does not provide employment visa sponsorship now or in the future. Applicants must be legally authorized to work in the United States without the need for current or future sponsorship. Equal Opportunity Employer Statement

Allia Health Group is proud to be an Equal Opportunity Employer where we are committed to fostering a diverse and inclusive workplace. We are committed to cultivating a culture where all team members feel valued & respected. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, gender identity or expression, sexual orientation, national origin, genetic information, disability, age, veteran status, or any other characteristics protected by applicable law.

Monday-Friday 8AM-5PM CST